These practices may violate the European Union's General Data Protection Regulations (GDPR)—a likelihood that the company's own data consent policy acknowledged and asked users to accept—as well as local laws.